All of lore.kernel.org
 help / color / mirror / Atom feed
From: Geert Uytterhoeven <geert+renesas@glider.be>
To: Jim Quinlan <james.quinlan@broadcom.com>,
	Christoph Hellwig <hch@lst.de>, Rob Herring <robh+dt@kernel.org>,
	Frank Rowand <frowand.list@gmail.com>
Cc: devicetree@vger.kernel.org, linux-pci@vger.kernel.org,
	linux-renesas-soc@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org,
	Geert Uytterhoeven <geert+renesas@glider.be>
Subject: [PATCH] dma-mapping: Fix 32-bit overflow with CONFIG_ARM_LPAE=n
Date: Mon, 26 Oct 2020 16:27:55 +0100	[thread overview]
Message-ID: <20201026152755.3738293-1-geert+renesas@glider.be> (raw)

On r8a7791/koelsch and shmobile_defconfig, PCIe probing fails with:

    rcar-pcie fe000000.pcie: Adjusted size 0x0 invalid
    rcar-pcie: probe of fe000000.pcie failed with error -22

of_dma_get_range() returns the following map:

    cpu_start 0x40000000 dma_start 0x40000000 size 0x080000000 offset 0
    cpu_start 0x00000000 dma_start 0x00000000 size 0x100000000 offset 0

If CONFIG_ARM_LPAE=n, dma_addr_t is 32-bit.  Hence when assigning
r->dma_start + r->size to dma_end, this value will be truncated to
32-bit, yielding zero when processing the second table entry.
Consequently, both dma_start and dma_end will be zero, leading to a zero
size.

Fix this by changing the dma_start and dma_end variables from dma_addr_t
to u64.

Fixes: e0d072782c734d27 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/of/device.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/of/device.c b/drivers/of/device.c
index 655dee422563f05f..3a469c79e6b05de4 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -93,7 +93,7 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
 {
 	const struct iommu_ops *iommu;
 	const struct bus_dma_region *map = NULL;
-	dma_addr_t dma_start = 0;
+	u64 dma_start = 0;
 	u64 mask, end, size = 0;
 	bool coherent;
 	int ret;
@@ -109,10 +109,10 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
 			return ret == -ENODEV ? 0 : ret;
 	} else {
 		const struct bus_dma_region *r = map;
-		dma_addr_t dma_end = 0;
+		u64 dma_end = 0;
 
 		/* Determine the overall bounds of all DMA regions */
-		for (dma_start = ~(dma_addr_t)0; r->size; r++) {
+		for (dma_start = ~0ULL; r->size; r++) {
 			/* Take lower and upper limits */
 			if (r->dma_start < dma_start)
 				dma_start = r->dma_start;
-- 
2.25.1


WARNING: multiple messages have this Message-ID
From: Geert Uytterhoeven <geert+renesas@glider.be>
To: Jim Quinlan <james.quinlan@broadcom.com>,
	Christoph Hellwig <hch@lst.de>, Rob Herring <robh+dt@kernel.org>,
	Frank Rowand <frowand.list@gmail.com>
Cc: devicetree@vger.kernel.org,
	Geert Uytterhoeven <geert+renesas@glider.be>,
	linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-renesas-soc@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org
Subject: [PATCH] dma-mapping: Fix 32-bit overflow with CONFIG_ARM_LPAE=n
Date: Mon, 26 Oct 2020 16:27:55 +0100	[thread overview]
Message-ID: <20201026152755.3738293-1-geert+renesas@glider.be> (raw)

On r8a7791/koelsch and shmobile_defconfig, PCIe probing fails with:

    rcar-pcie fe000000.pcie: Adjusted size 0x0 invalid
    rcar-pcie: probe of fe000000.pcie failed with error -22

of_dma_get_range() returns the following map:

    cpu_start 0x40000000 dma_start 0x40000000 size 0x080000000 offset 0
    cpu_start 0x00000000 dma_start 0x00000000 size 0x100000000 offset 0

If CONFIG_ARM_LPAE=n, dma_addr_t is 32-bit.  Hence when assigning
r->dma_start + r->size to dma_end, this value will be truncated to
32-bit, yielding zero when processing the second table entry.
Consequently, both dma_start and dma_end will be zero, leading to a zero
size.

Fix this by changing the dma_start and dma_end variables from dma_addr_t
to u64.

Fixes: e0d072782c734d27 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/of/device.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/of/device.c b/drivers/of/device.c
index 655dee422563f05f..3a469c79e6b05de4 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -93,7 +93,7 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
 {
 	const struct iommu_ops *iommu;
 	const struct bus_dma_region *map = NULL;
-	dma_addr_t dma_start = 0;
+	u64 dma_start = 0;
 	u64 mask, end, size = 0;
 	bool coherent;
 	int ret;
@@ -109,10 +109,10 @@ int of_dma_configure_id(struct device *dev, struct device_node *np,
 			return ret == -ENODEV ? 0 : ret;
 	} else {
 		const struct bus_dma_region *r = map;
-		dma_addr_t dma_end = 0;
+		u64 dma_end = 0;
 
 		/* Determine the overall bounds of all DMA regions */
-		for (dma_start = ~(dma_addr_t)0; r->size; r++) {
+		for (dma_start = ~0ULL; r->size; r++) {
 			/* Take lower and upper limits */
 			if (r->dma_start < dma_start)
 				dma_start = r->dma_start;
-- 
2.25.1


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

             reply	other threads:[~2020-10-26 15:28 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-26 15:27 Geert Uytterhoeven [this message]
2020-10-26 15:27 ` [PATCH] dma-mapping: Fix 32-bit overflow with CONFIG_ARM_LPAE=n Geert Uytterhoeven
2020-10-27  7:55 ` Christoph Hellwig
2020-10-27  7:55   ` Christoph Hellwig
2020-10-29 15:59   ` Christoph Hellwig
2020-10-29 15:59     ` Christoph Hellwig
2020-10-30 18:44     ` Rob Herring
2020-10-30 18:44       ` Rob Herring

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201026152755.3738293-1-geert+renesas@glider.be \
    --to=geert+renesas@glider.be \
    --cc=devicetree@vger.kernel.org \
    --cc=frowand.list@gmail.com \
    --cc=hch@lst.de \
    --cc=james.quinlan@broadcom.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pci@vger.kernel.org \
    --cc=linux-renesas-soc@vger.kernel.org \
    --cc=robh+dt@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.